fix(aws): support private subnets when deploying into existing VPCs

When --vpc-id is set and the chosen AZ contains only private subnets,
mapt now falls back to using any available subnet instead of failing.
Machines in private subnets connect outbound only (e.g. GitLab runner
registration), so inbound SSH rules, EIP allocation, load balancer
creation and SSH readiness checks are all skipped automatically.

Key changes:
- existingVPCNetwork tries GetPublicSubnetIDInAZ first; on failure
  falls back to GetAnySubnetIDInAZ and marks IsPublic=false
- NetworkResult.IsPublic propagates to all host deploy functions;
  EIP and LB are only created when IsPublic is true
- ComputeRequest respects nil Eip: no AssociatePublicIpAddress, no
  EIP association, no LB target groups; GetHostDnsName falls back
  to the instance private IP when neither EIP nor LB is present
- Security groups omit all inbound rules for private subnet deploys
- GetSubnetAZsForVPC returns all AZs (public and private) since
  private-subnet AZs are now valid deployment targets
- GetAnySubnetIDInAZ added to data/network.go
- Spot AZ resolution hardened: describeAvailabilityZonesAllAsync
  falls back to the standard describe when AllAvailabilityZones:true
  is SCP-blocked; getPlacementScores restricts the placement score
  request to regions where AZ ID resolution actually succeeded

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: adrianriobo

pkg/provider/aws/action/fedora/fedora.go

@@ -225,7 +225,7 @@ func (r *fedoraRequest) deploy(ctx *pulumi.Context) error {
 	ctx.Export(fmt.Sprintf("%s-%s", *r.prefix, outputUserPrivateKey),
 		keyResources.PrivateKey.PrivateKeyPem)
 	// Security groups
-	securityGroups, err := securityGroups(ctx, r.mCtx, r.prefix, nw.Vpc)
+	securityGroups, err := securityGroups(ctx, r.mCtx, r.prefix, nw.Vpc, nw.IsPublic)
 	if err != nil {
 		return err
 	}
@@ -257,7 +257,7 @@ func (r *fedoraRequest) deploy(ctx *pulumi.Context) error {
 		Eip:              nw.Eip,
 		LBTargetGroups:   []int{22},
 	}
-	if r.spot {
+	if r.spot && nw.IsPublic {
 		cr.Spot = true
 		cr.SpotPrice = *r.allocationData.SpotPrice
 	}
@@ -281,6 +281,11 @@ func (r *fedoraRequest) deploy(ctx *pulumi.Context) error {
 			return err
 		}
 	}
+	// Skip SSH readiness check for private subnets: the machine has no inbound
+	// connectivity and is expected to register itself outbound (e.g. GitLab runner).
+	if !nw.IsPublic {
+		return nil
+	}
 	return c.Readiness(ctx, command.CommandPing, *r.prefix, awsFedoraDedicatedID,
 		keyResources.PrivateKey, amiUserDefault, nw.Bastion, c.Dependencies)
 }
@@ -301,31 +306,32 @@ func manageResults(mCtx *mc.Context, stackResult auto.UpResult, prefix *string,
 	return output.Write(stackResult, mCtx.GetResultsOutputPath(), results)
 }
 
-// security group for mac machine with ingress rules for ssh and vnc
+// securityGroups builds the security group for the Fedora machine.
+// When public is true the SG allows SSH (and optional Cirrus) inbound from anywhere.
+// When false (private subnet, outbound-only workload) no inbound rules are added;
+// the default egress rule permits all outbound traffic so the runner can reach GitLab.
 func securityGroups(ctx *pulumi.Context, mCtx *mc.Context, prefix *string,
-	vpc *ec2.Vpc) (pulumi.StringArray, error) {
-	// ingress for ssh access from 0.0.0.0
+	vpc *ec2.Vpc, public bool) (pulumi.StringArray, error) {
 	var ingressRules []securityGroup.IngressRules
-	sshIngressRule := securityGroup.SSH_TCP
-	sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
-	ingressRules = []securityGroup.IngressRules{sshIngressRule}
-	// Integration ports
-	cirrusPort, err := cirrus.CirrusPort()
-	if err != nil {
-		return nil, err
-	}
-	if cirrusPort != nil {
-		ingressRules = append(ingressRules,
-			securityGroup.IngressRules{
-				Description: fmt.Sprintf("Cirrus port for %s", awsFedoraDedicatedID),
-				FromPort:    *cirrusPort,
-				ToPort:      *cirrusPort,
-				Protocol:    "tcp",
-				CidrBlocks:  infra.NETWORKING_CIDR_ANY_IPV4,
-			})
+	if public {
+		sshIngressRule := securityGroup.SSH_TCP
+		sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
+		ingressRules = []securityGroup.IngressRules{sshIngressRule}
+		cirrusPort, err := cirrus.CirrusPort()
+		if err != nil {
+			return nil, err
+		}
+		if cirrusPort != nil {
+			ingressRules = append(ingressRules,
+				securityGroup.IngressRules{
+					Description: fmt.Sprintf("Cirrus port for %s", awsFedoraDedicatedID),
+					FromPort:    *cirrusPort,
+					ToPort:      *cirrusPort,
+					Protocol:    "tcp",
+					CidrBlocks:  infra.NETWORKING_CIDR_ANY_IPV4,
+				})
+		}
 	}
-
-	// Create SG with ingress rules
 	sg, err := securityGroup.SGRequest{
 		Name:         resourcesUtil.GetResourceName(*prefix, awsFedoraDedicatedID, "sg"),
 		VPC:          vpc,
@@ -335,7 +341,6 @@ func securityGroups(ctx *pulumi.Context, mCtx *mc.Context, prefix *string,
 	if err != nil {
 		return nil, err
 	}
-	// Convert to an array of IDs
 	sgs := util.ArrayConvert([]*ec2.SecurityGroup{sg.SG},
 		func(sg *ec2.SecurityGroup) pulumi.StringInput {
 			return sg.ID()

pkg/provider/aws/action/rhel-ai/rhelai.go

@@ -247,7 +247,7 @@ func (r *rhelAIRequest) deploy(ctx *pulumi.Context) error {
 	ctx.Export(fmt.Sprintf("%s-%s", *r.prefix, outputUserPrivateKey),
 		keyResources.PrivateKey.PrivateKeyPem)
 	// Security groups
-	securityGroups, err := r.securityGroups(ctx, r.mCtx, nw.Vpc)
+	securityGroups, err := r.securityGroups(ctx, r.mCtx, nw.Vpc, nw.IsPublic)
 	if err != nil {
 		return err
 	}
@@ -269,7 +269,7 @@ func (r *rhelAIRequest) deploy(ctx *pulumi.Context) error {
 		LB:             nw.LoadBalancer,
 		Eip:            nw.Eip,
 		LBTargetGroups: r.lbTargetGroups()}
-	if r.allocationData.SpotPrice != nil {
+	if r.allocationData.SpotPrice != nil && nw.IsPublic {
 		cr.Spot = true
 		cr.SpotPrice = *r.allocationData.SpotPrice
 	}
@@ -293,6 +293,12 @@ func (r *rhelAIRequest) deploy(ctx *pulumi.Context) error {
 			return err
 		}
 	}
+	if !nw.IsPublic {
+		if r.autoStart {
+			return fmt.Errorf("--auto-start requires SSH access to configure RHAIIS; private subnet deployments do not support --auto-start")
+		}
+		return nil
+	}
 	if !r.autoStart {
 		return c.Readiness(ctx, command.CommandPing, *r.prefix, awsRHELDedicatedID,
 			keyResources.PrivateKey, amiUserDefault, nil, c.Dependencies)
@@ -325,22 +331,22 @@ func (r *rhelAIRequest) manageResults(stackResult auto.UpResult) error {
 	return output.Write(stackResult, r.mCtx.GetResultsOutputPath(), results)
 }
 
-// security group for mac machine with ingress rules for ssh and vnc
 func (r *rhelAIRequest) securityGroups(ctx *pulumi.Context, mCtx *mc.Context,
-	vpc *ec2.Vpc) (pulumi.StringArray, error) {
-	// ingress for ssh access from 0.0.0.0
-	sshIngressRule := securityGroup.SSH_TCP
-	sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
-	ingressRules := []securityGroup.IngressRules{sshIngressRule}
-	for _, port := range r.exposePorts {
-		rule := securityGroup.IngressRules{
-			Description: fmt.Sprintf("port-%d", port),
-			FromPort:    port,
-			ToPort:      port,
-			Protocol:    "tcp",
-			CidrBlocks:  infra.NETWORKING_CIDR_ANY_IPV4,
+	vpc *ec2.Vpc, public bool) (pulumi.StringArray, error) {
+	var ingressRules []securityGroup.IngressRules
+	if public {
+		sshIngressRule := securityGroup.SSH_TCP
+		sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
+		ingressRules = []securityGroup.IngressRules{sshIngressRule}
+		for _, port := range r.exposePorts {
+			ingressRules = append(ingressRules, securityGroup.IngressRules{
+				Description: fmt.Sprintf("port-%d", port),
+				FromPort:    port,
+				ToPort:      port,
+				Protocol:    "tcp",
+				CidrBlocks:  infra.NETWORKING_CIDR_ANY_IPV4,
+			})
 		}
-		ingressRules = append(ingressRules, rule)
 	}
 	// Create SG with ingress rules
 	sg, err := securityGroup.SGRequest{

pkg/provider/aws/action/rhel/rhel.go

@@ -230,7 +230,7 @@ func (r *rhelRequest) deploy(ctx *pulumi.Context) error {
 	ctx.Export(fmt.Sprintf("%s-%s", *r.prefix, outputUserPrivateKey),
 		keyResources.PrivateKey.PrivateKeyPem)
 	// Security groups
-	securityGroups, err := securityGroups(ctx, r.mCtx, r.prefix, nw.Vpc)
+	securityGroups, err := securityGroups(ctx, r.mCtx, r.prefix, nw.Vpc, nw.IsPublic)
 	if err != nil {
 		return err
 	}
@@ -267,7 +267,7 @@ func (r *rhelRequest) deploy(ctx *pulumi.Context) error {
 		LB:               nw.LoadBalancer,
 		Eip:              nw.Eip,
 		LBTargetGroups:   []int{22}}
-	if r.allocationData.SpotPrice != nil {
+	if r.allocationData.SpotPrice != nil && nw.IsPublic {
 		cr.Spot = true
 		cr.SpotPrice = *r.allocationData.SpotPrice
 	}
@@ -291,6 +291,9 @@ func (r *rhelRequest) deploy(ctx *pulumi.Context) error {
 			return err
 		}
 	}
+	if !nw.IsPublic {
+		return nil
+	}
 	return c.Readiness(ctx, command.CommandCloudInitWait, *r.prefix, awsRHELDedicatedID,
 		keyResources.PrivateKey, amiUserDefault, nw.Bastion, c.Dependencies)
 }
@@ -311,24 +314,23 @@ func manageResults(mCtx *mc.Context, stackResult auto.UpResult, prefix *string,
 	return output.Write(stackResult, mCtx.GetResultsOutputPath(), results)
 }
 
-// security group for mac machine with ingress rules for ssh and vnc
 func securityGroups(ctx *pulumi.Context, mCtx *mc.Context, prefix *string,
-	vpc *ec2.Vpc) (pulumi.StringArray, error) {
-	// ingress for ssh access from 0.0.0.0
-	sshIngressRule := securityGroup.SSH_TCP
-	sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
-	// Create SG with ingress rules
+	vpc *ec2.Vpc, public bool) (pulumi.StringArray, error) {
+	var ingressRules []securityGroup.IngressRules
+	if public {
+		sshIngressRule := securityGroup.SSH_TCP
+		sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
+		ingressRules = []securityGroup.IngressRules{sshIngressRule}
+	}
 	sg, err := securityGroup.SGRequest{
-		Name:        resourcesUtil.GetResourceName(*prefix, awsRHELDedicatedID, "sg"),
-		VPC:         vpc,
-		Description: fmt.Sprintf("sg for %s", awsRHELDedicatedID),
-		IngressRules: []securityGroup.IngressRules{
-			sshIngressRule},
+		Name:         resourcesUtil.GetResourceName(*prefix, awsRHELDedicatedID, "sg"),
+		VPC:          vpc,
+		Description:  fmt.Sprintf("sg for %s", awsRHELDedicatedID),
+		IngressRules: ingressRules,
 	}.Create(ctx, mCtx)
 	if err != nil {
 		return nil, err
 	}
-	// Convert to an array of IDs
 	sgs := util.ArrayConvert([]*ec2.SecurityGroup{sg.SG},
 		func(sg *ec2.SecurityGroup) pulumi.StringInput {
 			return sg.ID()

pkg/provider/aws/action/windows/windows.go

@@ -283,7 +283,7 @@ func (r *windowsServerRequest) deploy(ctx *pulumi.Context) error {
 	ctx.Export(fmt.Sprintf("%s-%s", *r.prefix, outputUserPrivateKey),
 		keyResources.PrivateKey.PrivateKeyPem)
 	// Security groups
-	securityGroups, err := securityGroups(ctx, r.mCtx, r.prefix, nw.Vpc)
+	securityGroups, err := securityGroups(ctx, r.mCtx, r.prefix, nw.Vpc, nw.IsPublic)
 	if err != nil {
 		return err
 	}
@@ -321,7 +321,7 @@ func (r *windowsServerRequest) deploy(ctx *pulumi.Context) error {
 		LB:               nw.LoadBalancer,
 		Eip:              nw.Eip,
 		LBTargetGroups:   []int{22, 3389}}
-	if r.allocationData.SpotPrice != nil {
+	if r.allocationData.SpotPrice != nil && nw.IsPublic {
 		cr.Spot = true
 		cr.SpotPrice = *r.allocationData.SpotPrice
 	}
@@ -347,6 +347,9 @@ func (r *windowsServerRequest) deploy(ctx *pulumi.Context) error {
 			return err
 		}
 	}
+	if !nw.IsPublic {
+		return nil
+	}
 	return c.Readiness(ctx, command.CommandPing, *r.prefix, awsWindowsDedicatedID,
 		keyResources.PrivateKey, *r.amiUser, nw.Bastion, c.Dependencies)
 }
@@ -368,26 +371,25 @@ func manageResults(mCtx *mc.Context, stackResult auto.UpResult, prefix *string,
 	return output.Write(stackResult, mCtx.GetResultsOutputPath(), results)
 }
 
-// security group for mac machine with ingress rules for ssh and vnc
 func securityGroups(ctx *pulumi.Context, mCtx *mc.Context, prefix *string,
-	vpc *ec2.Vpc) (pulumi.StringArray, error) {
-	// ingress for ssh access from 0.0.0.0
-	sshIngressRule := securityGroup.SSH_TCP
-	sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
-	rdpIngressRule := securityGroup.RDP_TCP
-	rdpIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
-	// Create SG with ingress rules
+	vpc *ec2.Vpc, public bool) (pulumi.StringArray, error) {
+	var ingressRules []securityGroup.IngressRules
+	if public {
+		sshIngressRule := securityGroup.SSH_TCP
+		sshIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
+		rdpIngressRule := securityGroup.RDP_TCP
+		rdpIngressRule.CidrBlocks = infra.NETWORKING_CIDR_ANY_IPV4
+		ingressRules = []securityGroup.IngressRules{sshIngressRule, rdpIngressRule}
+	}
 	sg, err := securityGroup.SGRequest{
-		Name:        resourcesUtil.GetResourceName(*prefix, awsWindowsDedicatedID, "sg"),
-		VPC:         vpc,
-		Description: fmt.Sprintf("sg for %s", awsWindowsDedicatedID),
-		IngressRules: []securityGroup.IngressRules{
-			sshIngressRule, rdpIngressRule},
+		Name:         resourcesUtil.GetResourceName(*prefix, awsWindowsDedicatedID, "sg"),
+		VPC:          vpc,
+		Description:  fmt.Sprintf("sg for %s", awsWindowsDedicatedID),
+		IngressRules: ingressRules,
 	}.Create(ctx, mCtx)
 	if err != nil {
 		return nil, err
 	}
-	// Convert to an array of IDs
 	sgs := util.ArrayConvert([]*ec2.SecurityGroup{sg.SG},
 		func(sg *ec2.SecurityGroup) pulumi.StringInput {
 			return sg.ID()

pkg/provider/aws/data/azs.go

@@ -44,6 +44,10 @@ type AvailabilityZonesResult struct {
 
 func describeAvailabilityZonesAllAsync(ctx context.Context, regionName string, c chan AvailabilityZonesResult) {
 	data, err := describeAvailabilityZonesAll(ctx, regionName)
+	if err != nil || len(data) == 0 {
+		// AllAvailabilityZones: true may be SCP-blocked or unsupported; fall back.
+		data, err = describeAvailabilityZones(ctx, regionName, nil)
+	}
 	c <- AvailabilityZonesResult{AvailabilityZones: data, Err: err}
 }
 
@@ -131,10 +135,15 @@ func describeAvailabilityZonesByRegions(ctx context.Context, regions []string) m
 	}
 	for i := 0; i < len(regions); i++ {
 		availabilityZonesResult := <-c
-		if availabilityZonesResult.Err == nil {
-			region := availabilityZonesResult.AvailabilityZones[0].RegionName
-			result[*region] = append(result[*region], availabilityZonesResult.AvailabilityZones...)
+		if availabilityZonesResult.Err != nil {
+			logging.Debugf("could not describe AZs: %v", availabilityZonesResult.Err)
+			continue
+		}
+		if len(availabilityZonesResult.AvailabilityZones) == 0 {
+			continue
 		}
+		region := availabilityZonesResult.AvailabilityZones[0].RegionName
+		result[*region] = append(result[*region], availabilityZonesResult.AvailabilityZones...)
 	}
 	close(c)
 	return result

pkg/provider/aws/data/network.go

@@ -91,7 +91,9 @@ func getPublicSubnets(ctx context.Context, client *ec2.Client, vpcID string) (su
 	return
 }
 
-// GetSubnetAZsForVPC returns the unique AZ names of all subnets that belong to the specified VPC.
+// GetSubnetAZsForVPC returns the unique AZ names of all subnets in the specified VPC.
+// Both public and private subnets are included; callers that need public-only access
+// should use GetPublicSubnetIDInAZ and handle the private-subnet fallback themselves.
 func GetSubnetAZsForVPC(ctx context.Context, region, vpcID string) ([]string, error) {
 	cfg, err := getConfig(ctx, region)
 	if err != nil {
@@ -123,6 +125,29 @@ func GetSubnetAZsForVPC(ctx context.Context, region, vpcID string) ([]string, er
 	return azs, nil
 }
 
+// GetAnySubnetIDInAZ returns the first available subnet (public or private) in the
+// given AZ within the specified VPC. Used as a fallback when no public subnet exists.
+func GetAnySubnetIDInAZ(ctx context.Context, region, vpcID, az string) (*string, error) {
+	cfg, err := getConfig(ctx, region)
+	if err != nil {
+		return nil, err
+	}
+	client := ec2.NewFromConfig(cfg)
+	subnetsOutput, err := client.DescribeSubnets(ctx, &ec2.DescribeSubnetsInput{
+		Filters: []ec2types.Filter{
+			{Name: aws.String(filterVPCID), Values: []string{vpcID}},
+			{Name: aws.String(filterAvailabilityZone), Values: []string{az}},
+		},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to describe subnets in VPC %s AZ %s: %w", vpcID, az, err)
+	}
+	if len(subnetsOutput.Subnets) == 0 {
+		return nil, fmt.Errorf("no subnet found in VPC %s AZ %s", vpcID, az)
+	}
+	return subnetsOutput.Subnets[0].SubnetId, nil
+}
+
 // GetPublicSubnetIDInAZ returns a public subnet ID in the given AZ within the specified VPC.
 func GetPublicSubnetIDInAZ(ctx context.Context, region, vpcID, az string) (*string, error) {
 	cfg, err := getConfig(ctx, region)

pkg/provider/aws/data/spot.go

@@ -462,9 +462,23 @@ type placementScoreResult struct {
 // skipped. Returns a map of region → AZ scores filtered to those meeting minPlacementScore.
 func getPlacementScores(args placementScoreArgs, regions []string) (map[string][]placementScoreResult, error) {
 	azsByRegion := describeAvailabilityZonesByRegions(args.ctx, regions)
+	// Restrict placement score request to regions where AZ IDs can be resolved.
+	// If DescribeAvailabilityZones failed for a region (SCP restriction, region not
+	// enabled, etc.) scores returned for that region cannot be matched to an AZ name.
+	resolvedRegions := make([]string, 0, len(regions))
+	for _, r := range regions {
+		if _, ok := azsByRegion[r]; ok {
+			resolvedRegions = append(resolvedRegions, r)
+		} else {
+			logging.Debugf("excluding region %s from spot search: AZ information unavailable", r)
+		}
+	}
+	if len(resolvedRegions) == 0 {
+		return nil, fmt.Errorf("no regions with resolvable AZ information available for spot search")
+	}
 	var lastErr error
 	for _, apiRegion := range args.apiRegions {
-		result, err := placementScoresViaRegion(apiRegion, args, regions, azsByRegion)
+		result, err := placementScoresViaRegion(apiRegion, args, resolvedRegions, azsByRegion)
 		if err != nil {
 			logging.Debugf("placement score API unavailable in region %s: %v, trying next", apiRegion, err)
 			lastErr = err